Scopes go on the outbound <a href="" that a user clicks on
<a href=""
Not in the code to token exchange